Bait-and-Recover: Poisoning Internal Refusal Signals to Defend LLMs against White-Box Editing Jailbreaks

Tian Gao; Zhipeng Xie; Yuhao Wu; Junhua Liu; Xin Fang

cs.CRSep 5, 2026

Bait-and-Recover: Poisoning Internal Refusal Signals to Defend LLMs against White-Box Editing Jailbreaks

Authors: Tian Gao, Zhipeng Xie, Yuhao Wu, Junhua Liu, Xin Fang

Organizations: Anhui Laboratory for Safe Artificial Intelligence in the Yangtze River Delta · iFlytek Research

Abstract

Open-weight large language models face a low-cost white-box threat from representation engineering attacks. Attackers can estimate refusal directions and search for projection-matrix edits that suppress safety alignment while preserving general capabilities, within minutes on a single GPU and without gradient-based training. We propose Bait-and-Recover, a weight-level defense that places a bait adapter where attackers read activations and a paired recovery adapter at the subsequent layer. Trained via gradient routing, this decouples the observation path from the behavior path. By actively poisoning the residual signal used for measurement, Bait-and-Recover disrupts the attacker's edit search, while the recovery layer restores clean downstream computation. Across four open-weight models, our defense raises the minimum refusal rate against white-box edit searches from 16.25% to 71.75% under a strict behavior-preservation budget (KL <= 0.10), with negligible impact on general benchmarks. By invalidating the core measurement assumption of these attacks, observation-path poisoning offers a practical complement to behavior-level safety training.

Figures & tables

Figure 1: Overview of the alternating-pass Bait-and-Recover pipeline. A clean-model layer-prior analysis determines the bait band before training; Training Pass A covers one layer parity, Training Pass B starts from the merged Pass A checkpoint and covers the complementary parity, and the final checkpoint is evaluated against the same white-box Heretic search used for the baseline. The layer-joint box denotes local tuning inside a pass over neighboring trained pairs, not a joint optimization between Pass A and Pass B.

Figure 2: Layer-wise Fisher retention during Qwen3-4B-Instruct training. Retention is after-pass Fisher divided by the before-pass reference (clean model for Pass A; Pass A model for Pass B). The shaded band is a visual reference around unchanged retention.

Model	L	Band	Pass A	Pass B	$r$
Qwen3-4B-Instruct	36	14–34	odd 15–33	even 14–34	4–16
Qwen3-8B	36	14–34	odd 15–33	even 14–34	7–16
Gemma-3-1B-IT	26	10–24	odd 11–23	even 10–24	4
Gemma-3-12B-IT	48	18–38	odd 19–37	even 18–38	4–16

Table 1: Evaluated models and defense configurations. The bait band is chosen by the clean-model layer-prior rule; Pass A/B list the alternating bait-layer ranges used by the two-stage schedule, and

r

is the realized LoRA rank range after applying the rank-selection rule.

Model	Pass A	Pass B	Base	Def.	$\Delta$	Base	Def.	$\Delta$
	General-prompt KL		MMLU-Redux			IFEval
Qwen3-4B-Instruct	0.016	0.020	0.7549	0.7538	-0.0011	0.8244	0.8373	+0.0129
Qwen3-8B	0.007	0.010	0.7782	0.7761	-0.0021	0.8373	0.8373	+0.0000
Gemma-3-1B-IT	0.066	0.079	0.4180	0.4193	+0.0013	0.5730	0.5342	-0.0388
Gemma-3-12B-IT	0.049	0.085	0.7528	0.7506	-0.0022	0.8059	0.8096	+0.0037
Mean	0.035	0.049	0.6760	0.6750	-0.0010	0.7602	0.7546	-0.0055

Table 2: Behavior-preservation diagnostics and general capability retention after defense. KL is measured on held-out general prompts after Pass A and Pass B; Pass B is the final defended checkpoint. MMLU reports MMLU-Redux accuracy, IFEval reports prompt-level strict accuracy, and

\Delta

is defended minus baseline.

	$\mathrm{KL}\leq 0.05$			$\mathrm{KL}\leq 0.10$			$\mathrm{KL}\leq 0.20$			$\mathrm{KL}\leq 1.0$
Model	Base	Def.	$\Delta$	Base	Def.	$\Delta$	Base	Def.	$\Delta$	Base	Def.	$\Delta$
Qwen3-4B-Instruct	97	78	$-19$	46	78	$+32$	24	65	$+41$	5	60	$+55$
Qwen3-8B	36	67	$+31$	11	60	$+49$	11	50	$+39$	8	33	$+25$
Gemma-3-1B-IT	17	84	$+67$	5	67	$+62$	3	64	$+61$	2	64	$+62$
Gemma-3-12B-IT	12	82	$+70$	3	82	$+79$	2	82	$+80$	0	59	$+59$
Mean	40.50	77.75	$+37.25$	16.25	71.75	$+55.50$	10.00	65.25	$+55.25$	3.75	54.00	$+50.25$

Table 3: Main Heretic attack result across four KL budgets. Each cell reports the minimum refusal rate (%, out of 100 harmful prompts; higher is better); bold marks the

\mathrm{KL}\leq 0.10

primary evaluation budget.

Model	Global	Per-layer
Qwen3-4B-Instruct	46/ 78 / $+32$	94/81/ $-13$
Qwen3-8B	11/ 60 / $+49$	99/88/ $-11$
Gemma-3-1B-IT	5/ 67 / $+62$	22/82/ $+60$
Gemma-3-12B-IT	26/ 83 / $+57$	3/82/ $+79$
Mean	22.00/ 72.00 / $+50.00$	54.50/83.25/ $+28.75$

Table 4: Heretic minimum refusals at the

\mathrm{KL}\leq 0.10

primary evaluation budget, split by attacker direction scope. Each entry reports base/defended/

\Delta

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

KL	Q3-4B	Q3-8B	G3-1B	G3-12B
$\leq 0.01$	100/100/0	97/95/-2	88/NA/NA	72/82/+10
$\leq 0.02$	97/97/0	78/84/+6	88/84/-4	37/82/+45
$\leq 0.03$	97/78/-19	44/78/+34	77/84/+7	37/82/+45
$\leq 0.05$	97/78/-19	36/67/+31	17/84/+67	12/82/+70
$\leq 0.075$	97/78/-19	15/60/+45	17/67/+50	8/82/+74
$\leq 0.10$	46/78/+32	11/60/+49	5/67/+62	3/82/+79

Appendix

Table 5: Full overall Heretic results. Models are abbreviated: Q3-4B (Qwen3-4B-Instruct), Q3-8B (Qwen3-8B), G3-1B (Gemma-3-1B-IT), G3-12B (Gemma-3-12B-IT).

KL	Q3-4B	Q3-8B	G3-1B	G3-12B
$\leq 0.01$	100/100/0	97/95/-2	88/NA/NA	89/83/-6
$\leq 0.02$	97/97/0	78/84/+6	88/84/-4	61/83/+22
$\leq 0.03$	97/78/-19	44/78/+34	77/84/+7	61/83/+22
$\leq 0.05$	97/78/-19	36/67/+31	17/84/+67	61/83/+22
$\leq 0.075$	97/78/-19	15/60/+45	17/67/+50	61/83/+22
$\leq 0.10$	46/78/+32	11/60/+49	5/67/+62	26/83/+57

Appendix

Table 6: Full global-direction Heretic results.

KL	Q3-4B	Q3-8B	G3-1B	G3-12B
$\leq 0.01$	NA/NA/NA	NA/99/NA	94/NA/NA	72/82/+10
$\leq 0.02$	NA/NA/NA	NA/99/NA	90/NA/NA	37/82/+45
$\leq 0.03$	NA/NA/NA	100/99/-1	88/88/0	37/82/+45
$\leq 0.05$	100/95/-5	100/99/-1	78/86/+8	12/82/+70
$\leq 0.075$	99/95/-4	100/97/-3	68/82/+14	8/82/+74
$\leq 0.10$	94/81/-13	99/88/-11	22/82/+60	3/82/+79

Appendix

Table 7: Full per-layer-direction Heretic results. “NA” means no trial landed inside the KL bucket.

		Bait		Recovery
Pass	Layer	Ref.	Def.	Ref.	Def.
A	15	0.89	0.54	1.06	0.99
A	17	1.05	0.61	1.26	1.16
A	19	1.54	0.98	1.35	1.23
A	21	1.19	0.70	1.19	1.07
A	23	1.23	0.79	1.17	1.04

Appendix

Table 8: Raw Fisher values for Qwen3-4B-Instruct. “Ref.” denotes the before-pass reference used as the retention denominator.

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 324 papers

Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attacks
May 26, 2026Kevin Kuo, Virginia Smith, Chhavi YadavLLM Fine-Tuning Adversarial Attacks on LLMs
Carnegie Mellon University · Simons Institute, UC Berkeley
Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors
Apr 14, 2026Rui Yin, Tianxu Han, Naen Xu +8LLM Backdoor Attacks Language Model Editing
Zhejiang University · Palo Alto Networks · OPPO Research Institute +2
Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration
Sep 14, 2026Aashiq Muhamed, Mona T. Diab, Virginia SmithAdversarial Attacks on LLMs LLM Safety
Carnegie Mellon University

May 26, 2026J/K move · Enter open · S save

Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attacks

Kevin Kuo, Virginia Smith, Chhavi Yadav

Carnegie Mellon University · Simons Institute, UC Berkeley

LLM Fine-Tuning Adversarial Attacks on LLMs Open-Weight Language Models LLM Safety LLM Jailbreak Attacks

Open paper AskPDF arXiv

Recent defenses for safeguarding open-weight large language models (LLMs) are intended to prevent adversarial usage. Underlying these defenses is an assumption that new harmful behavior is learned through fine-tuning rather than elicited by jailbreaking the model. Yet, pretrained LLMs already encode substantial harmful knowledge across many domains, which raises an important question: can an adversary jailbreak safeguarded models, to achieve harmful usage without fine-tuning at all? In this paper, we show that open-weight safeguards are susceptible to simpler strategies that, despite being well known, have not been systematically evaluated against these safeguards. Specifically, we evaluate two low-cost attacks--abliteration and prefilling--that do not rely on gradient-based optimization. Across three harmfulness evaluation benchmarks (BeaverTails, HarmBench, and AdvBench), these attacks increase attack success rates against safeguarded open-weight models from below 10% to a range of 16%-96%. To mitigate this vulnerability, we introduce abliteration-resistant tuning (ART), which incorporates an abliteration-based objective into training. ART can be layered onto existing defenses and reduces the success rates of abliteration, prefilling, and their combination by 10%-20%. These findings indicate that the attack surface for open-weight models is broader than previously characterized, and that evaluations of safeguarding defenses should incorporate a more diverse set of attack strategies beyond adversarial fine-tuning.

Abstract

LLM Security

Explore similar work

Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attacks

Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors

Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration